Understanding Calico's eBPF data-plane
summary
Calico’s eBPF data plane replaces most iptables handling with in-kernel bytecode that bypasses host netns, improving latency and scaling to clusters with thousands of services. It implements connect-time load balancing (per-connection state with a single contract entry), uses XLAN tunnels for nodePort traffic and optionally XDP for early drops, provides the calico bpf inspection tool to dump policies, routes, counters and contracts, and is redesigning program load to work around slow verifier and add IPv6.
AI-written summary · about
chapters (9)
- 0:00Introduction to Calico
- 4:26Why a new data plane?
- 8:36Understanding eBPF
- 12:09Data plane architecture
- 17:44Handling host traffic
- 22:12External traffic modes
- 25:02Complexities of eBPF
- 29:17Debugging and visibility
- 35:39Monitoring and future
related talks
32mCalico Networking with eBPF
29mOpening the Black Box: Understanding and Troubleshooting Calico’s eBPF Data Plane
23mContainer and Kubernetes security policy design: 10 critical best practices
30mAll You Can Eat Networking. Kubernetes Goodness for the Hungriest Workloads
29mCalico/VPP: Using Calico’s Pluggable Dataplanes for Fun and Fast Networking
32mUsing Open-Source Software to Secure Cloud-Native Applications
31mHigh-Performance Cloud Networking With Calico and Vec...
47mInto the Heart of the eBPF Hive!